Re: [Ietf-and-github] RobWilton review of draft-ietf-git-using-github-05

["Rob Wilton (rwilton)" <[e-mail]>]

Hi Martin,

> -----Original Message-----
> From: Martin Thomson <[e-mail]>
> Sent: 16 March 2020 04:12
> To: Rob Wilton (rwilton) <[e-mail]>; The IESG <[e-mail]>;
> [e-mail]
> Cc: [e-mail]; [e-mail]; Christopher Wood
> <[e-mail]>
> Subject: Re: RobWilton review of draft-ietf-git-using-github-05
> 
> On Fri, Mar 13, 2020, at 23:03, Rob Wilton (rwilton) wrote:
> >   I personally think that having a
> > > backup is sensible.  At the same time, having a single account with
> > > access to many repositories is a bit scary.
> > [RW]
> > Hum yes, maybe having the Secretariat on all WGs is not a good choice.
> > Perhaps we should say that all ADs for the area should be owners
> > rather than just the responsible AD, and there must always be a
> > minimum of 2 owners?  So, for the general area perhaps it would be the
> > AD and the Secretariat?
> >
> > Obviously this would need to be aligned with the config draft.
> 
> I will raise the question with the WG, as it is not limited to this draft.
> The -configuration draft has a broader net that includes the responsible
> AD, the ADs for the area, and the secretariat.
[RW] 
Thanks.


> 
> > [RW]
> > My concern is less about losing the data (since that is being backed
> > up), but more about losing control of an account/organization that is
> > under the IETF's name.  I'm not sure what policies Github has for
> > recovering an account/organisation that one loses control over, but
> > I'm sure it would be hassle, and embarrassing.
> 
> I'm sure that the process is torturous.  I tagged some text on to other
> changes I'm making.  See https://github.com/ietf-gitwg/using-
> github/pull/52/commits/302feb524c457f10a3fea21dcee140bd5dc6218e
[RW] 

This looks along the right lines to me.  I would suggest adding "users" to the list of folks who should use best security practices, but happy to leave this to your discretion.



> 
> > FWIW: It is this sort of article that I am concerned about:
> > https://nakedsecurity.sophos.com/2019/03/25/thousands-of-coders-are-le
> > aving-their-crown-jewels-exposed-on-github/
> >
> > Some of the contributors to IETF will be quite new to git/github etc,
> > so really it is about warning them about stuff they should be careful
> > to avoid.  Even a sentence or two in the security considerations might
> > help.
> 
> I think that this is a question of scope.  Personally, I think that's
> going a little outside the remit of the draft.  And I'd rather attack this
> particular problem with tools.
[RW] 

I agree, that tooling is the best solution to this.

I think that tooling, in addition to the paragraph that you linked to above, is enough for me.


> 
> > FWIW, it is this sort of issue that I am concerned about:
> > https://networkengineering.stackexchange.com/questions/44010/is-ipv10-
> > a-joke-or-a-serious-rfc-draft
> 
> Ah, that old problem. :/
> 
> I don't think that we can help with that, other than avoiding paving the
> path to having something look official.  We've talked about having tools
> like xml2rfc produce different styling for individual drafts than is used
> for presenting "official" content on IETF-controlled servers.  That might
> help, though things progress very slowly on this front.
[RW] 

I agree.

Thanks for incorporating my review comments.

Regards,
Rob